last executing test programs: 6.391318324s ago: executing program 1 (id=133): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40050}, 0x2040000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x5e, 0xc, 0x0, 0x1, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x100000020, 0x3, 0x2, 0x4000000106c, 0x102, 0x8000000000000, 0x1000000003, 0x0, 0x8, 0x10, 0x5, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.475687603s ago: executing program 4 (id=142): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x80, 0xfffffffd, 0x0, "985d00"}) r1 = syz_open_pts(r0, 0x40601) ioctl$TIOCCONS(r1, 0x541d) 5.475372473s ago: executing program 1 (id=143): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x1}, @TCA_HHF_NON_HH_WEIGHT={0x8, 0x7, 0xd}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.475223483s ago: executing program 4 (id=144): r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r2}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0xfffffffe, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000002940)=[{0x0, 0xdd12}, {0x0, 0x2300}], 0x2}, 0x200408d0) 5.444815184s ago: executing program 4 (id=145): syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000004e40)={0xff, 0x11, 0x4, 0x0, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fbf29c"}) 5.339578948s ago: executing program 1 (id=148): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd8d000000000000000002ff"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) 5.336356128s ago: executing program 1 (id=150): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000001140012800c0001006d6163766c616e00dbff028008000500", @ANYRES32=r0, @ANYBLOB="080004007f"], 0x50}}, 0x0) 5.306234489s ago: executing program 1 (id=151): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000560900a1004daf25cee2d5d1c1"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000040), 0x0, 0x6040) 4.775558516s ago: executing program 2 (id=154): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3f000000) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) 4.771422116s ago: executing program 2 (id=155): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmmsg$inet6(r0, &(0x7f0000002040)=[{{&(0x7f0000000040)={0xa, 0x4e22, 0x7, @loopback}, 0x1c, &(0x7f0000001400), 0x0, &(0x7f00000014c0)=[@pktinfo={{0x20, 0x29, 0x32, {@dev={0xfe, 0x80, '\x00', 0x24}}}}, @hopopts_2292={{0x1d4, 0x29, 0x36, {0x0, 0x37, '\x00', [@generic={0xfd, 0x41, "fa6c08b0a9a6b450f16d2e959060a57a0956276d28efe988c87a3c3cea2b887aa18de4cc7b66f57e4f4d82ef88063dd6ba53c07fa3a75cd5a10a0f36804bd8c96a"}, @generic={0x4, 0xeb, "ea16055b898b26b658ab5fa9ddd45cbb1065936cfe2b2d6244d1bfed0c8a9e70bcae5d1b8cad1b0f073d7184f4464dcb70c39e5d6b34cb46323eaccd8d3c86672b4e1b188acd58a3edac1ca6013fe15084122d1678bc0cdb8583dae5b9c4e21d838f3baf66db5e37f511258778ddb40b86c07ec6dcccd5b44c6150c1b16f0c57c869c165b19081d68fce26cd0fcea6ee841bb24bc31b44430f8ee83c1bf4b5686485610828bed131746dcd58858ed42671422d873ba8ea7b71a0a1de06e8b5e1011bce667395677b247dd7b76d9bfb40d0db2ecc4ccaf5e00328ed58ac8cc1d9ef0b351391b57d30769723"}, @hao={0xc9, 0x10, @private2={0xfc, 0x2, '\x00', 0x2}}, @hao={0xc9, 0x10, @private1}, @generic={0x89, 0x63, "1cff1bc59b3d1912bb957a6ea8760c483ccaef0936afa63bedc18d6ea8cf4b80586def3305fe0ead3bd1c4cfee5bebba0a78104f72f7bdb49a07b76a97ac02d0454f8a23217a37bd6c5ffe83b16cf11428a256a2b719e35f03d7e4c26b1b32ca142a4a"}]}}}], 0x1f4}}, {{0x0, 0x0, 0x0}}], 0x2, 0x48801) 4.758669916s ago: executing program 2 (id=156): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 4.591691402s ago: executing program 3 (id=160): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000100)=ANY=[@ANYBLOB="12010d6b000e00000004"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 3.912454614s ago: executing program 2 (id=161): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) flistxattr(r0, &(0x7f0000000300)=""/154, 0x9a) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) r5 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 3.827924256s ago: executing program 2 (id=162): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 3.793060597s ago: executing program 4 (id=164): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x1, 0x3, 0x0, 0x13, "00176a0000fcf7ffffa5e8673608f7ecfeff00"}) r1 = syz_open_pts(r0, 0x48182) r2 = dup3(r1, r0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x2) write$binfmt_elf64(r2, 0x0, 0x0) 3.491514217s ago: executing program 4 (id=170): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000034709d405f0530c6acb60102030109021200fd000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000400)={0x20, 0x1, 0x1, "af"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000100)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000480)={0x24, &(0x7f00000002c0)={0x20, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.269419594s ago: executing program 1 (id=171): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_connect$uac2(0x4, 0x9c, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x48, 0x499, 0x1039, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0x85, 0xe6d65e2c16ddbb6c, 0x7, {0x8, 0xb, 0x2, 0x2, 0x1, 0x5, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x9, 0x4, 0x2a, 0x3}, [@feature_unit={0x7, 0x24, 0x6, 0x6, 0x4, [0x1]}, @effect_unit={0x11, 0x24, 0x7, 0x2, 0x4, 0x4, [0x1, 0x2, 0x2, 0x0, 0x2]}, @processing_unit={0x9, 0x24, 0x8, 0x3, 0x1, [0x3, 0x1]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x2, 0x1, 0x0, {0x8, 0x25, 0x1, 0x2, 0x3c, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x1, 0x0, 0x28, {0x8, 0x25, 0x1, 0x83, 0x3f, 0x10, 0x8000}}}}}}}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 1.52782529s ago: executing program 3 (id=172): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(r2, 0x5501) write$uinput_user_dev(r1, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x7f5d, 0x3, 0x6, 0x5, 0x10000, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x0, 0xb, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x5, 0x2, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x9, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0x8, 0xbc1, 0x80000, 0x0, 0x5e81b39d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x1, 0x6, 0x525ba681, 0x4f74, 0x9, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x0, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x6, 0x47, 0x7, 0x0, 0x11, 0x3, 0xffd, 0x7, 0x7, 0x8000, 0x7ff, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x6, 0xc41f, 0x80000001, 0x6, 0xffffffff, 0x0, 0xd5, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0xffffb027, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400, 0x8, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) read$hiddev(r2, &(0x7f0000000040)=""/117, 0x75) 1.52750797s ago: executing program 3 (id=173): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)={0x78, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x64, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, "325f73352e2100000000000000436384"}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "9ea2d328893918792a5ca222a6ad61b1143aa3a6ace61df176c9eac62648eecc490695d9"}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x806}, 0x0) 1.52732371s ago: executing program 3 (id=174): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x1, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x1, "65a252e7cb7a5918c004a9971a46afced2c32642b1ec9fe34818d8ccd82041b7", "c930713c550e74ee13c2638ac75b2a9666efd31a34fce4498df8105d8bd8ed283a220c3a9becd8a70d3607ea8270d351", "ae12e16b560f2f8ac4ca3e745ce285f12f6e8719e7f1e7f286a68f76", {"180aa8fb47e93e000000498000", "55e824bb69e833bd36300b088233545a"}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/185, 0xb9}], 0x1}, 0xfffffffe}, {{0x0, 0x0, &(0x7f00000013c0)=[{0x0}, {&(0x7f0000000880)=""/75, 0x4b}], 0x2}, 0x7ff}], 0x2, 0x10103, 0x0) 1.520086291s ago: executing program 3 (id=175): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="01010100ffff000ae5ee4e2de608351100df86dd"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x200000, {0x0, 0x0, 0x0, 0x0, 0x90, 0x800}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4000880) 1.469775042s ago: executing program 3 (id=176): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000840)={0x34, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001080)={0x24, &(0x7f0000000e00)={0x0, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000dc0)={0x10, &(0x7f0000000640)={0x0, 0x30}, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) 795.991074ms ago: executing program 2 (id=177): syz_usb_connect(0x0, 0xaf, &(0x7f0000000100)=ANY=[@ANYBLOB="12014101217ad620e71a039008440102030109029d00010000100009044a020288dcb20009050602000202000a090582"], 0x0) read$char_usb(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) 427.946656ms ago: executing program 4 (id=180): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001580)={0x34, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) 387.700257ms ago: executing program 0 (id=181): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 375.723238ms ago: executing program 0 (id=182): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000014001a80100005"], 0x34}}, 0x0) 319.653599ms ago: executing program 0 (id=183): openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$pfkey(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$USBDEVFS_GET_SPEED(r0, 0x551f) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x1800, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setresuid(0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000f, 0x204031, 0xffffffffffffffff, 0x7c778000) syslog(0x2, &(0x7f0000001a00)=""/37, 0x25) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r1, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1}}], 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0500000003f01f00810000007f00000001000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000398ae159bbb15375000000000000000000000000000000000000000000007e242e1ed50e7483650dc43fb91ad9b87ff944ce733091b8a55fb2a97d24858ed333ae32aa6e31c6b09ce619ef83e416a771cdd6b60c03924b190ab52ea92441a2365e3719258e62927dbb9a4e61ac53e57e009edab7fccd4f6ba368f7a5e4d054321888612c9d7aed6a3f07e4b05a65e22551b56816c595829651b94562a0d9981ac0b006336a5246d3b53177"], 0x50) clock_nanosleep(0x71eb24ce632d603a, 0x1, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0x3, &(0x7f0000000340)={r4, 0x0, 0x0}, 0x10) 223.000582ms ago: executing program 0 (id=184): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000280)={r1, 0x0, 0x400001, 0x0, 0x5, 0x0, 0x0}) unshare(0x2040400) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 59.450288ms ago: executing program 0 (id=185): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r1, 0x629, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_TX={0x5, 0xc, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000104}, 0x40) 0s ago: executing program 0 (id=186): r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r1, &(0x7f0000000140)='./file0\x00') syz_usb_connect(0x3, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0xd6, 0xb6, 0x8d, 0x10, 0x5ac, 0x246, 0x27b1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0xfa, 0x10, 0x3f, "", [{{0x9, 0x4, 0x14, 0x4, 0x0, 0x3, 0x46, 0x2, 0x2}}]}}]}}, 0x0) openat(r1, &(0x7f00000000c0)='./file0\x00', 0x10f602, 0x52abe154ad664fa4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.11' (ED25519) to the list of known hosts. [ 22.055377][ T30] audit: type=1400 audit(1781691217.577:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.058863][ T277] cgroup: Unknown subsys name 'net' [ 22.078056][ T30] audit: type=1400 audit(1781691217.577:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.105397][ T30] audit: type=1400 audit(1781691217.607:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.105842][ T277] cgroup: Unknown subsys name 'devices' [ 22.246564][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.252203][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.362202][ T30] audit: type=1400 audit(1781691217.877:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.385576][ T30] audit: type=1400 audit(1781691217.877:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.410859][ T30] audit: type=1400 audit(1781691217.877:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.422327][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.442839][ T30] audit: type=1400 audit(1781691217.967:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.468424][ T30] audit: type=1400 audit(1781691217.967:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.485074][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.495984][ T30] audit: type=1400 audit(1781691217.997:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.528781][ T30] audit: type=1400 audit(1781691217.997:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.167048][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.174174][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.181765][ T285] device bridge_slave_0 entered promiscuous mode [ 23.195967][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.203036][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.210546][ T285] device bridge_slave_1 entered promiscuous mode [ 23.225576][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.232755][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.240313][ T287] device bridge_slave_0 entered promiscuous mode [ 23.249938][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.257156][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.264717][ T287] device bridge_slave_1 entered promiscuous mode [ 23.297642][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.304796][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.312285][ T289] device bridge_slave_0 entered promiscuous mode [ 23.320892][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.328077][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.335797][ T289] device bridge_slave_1 entered promiscuous mode [ 23.446232][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.453311][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.460803][ T286] device bridge_slave_0 entered promiscuous mode [ 23.470454][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.477745][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.485438][ T286] device bridge_slave_1 entered promiscuous mode [ 23.511740][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.518871][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.526420][ T288] device bridge_slave_0 entered promiscuous mode [ 23.567001][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.574107][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.581802][ T288] device bridge_slave_1 entered promiscuous mode [ 23.594270][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.601400][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.608735][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.615791][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.674518][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.681643][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.688994][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.696051][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.718502][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.725596][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.745485][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.752540][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.759885][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.766946][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.781190][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.789079][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.796496][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.803689][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.811313][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.818645][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.826436][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.833617][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.860995][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.869364][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.876475][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.906193][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.914931][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.923141][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.930232][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.938066][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.946584][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.953636][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.976170][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.984744][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.991812][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.000086][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.008233][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.016471][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.023914][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.031490][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.039853][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.048310][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.055392][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.062769][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.071076][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.078158][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.097355][ T287] device veth0_vlan entered promiscuous mode [ 24.105040][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.113729][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.122205][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.130033][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.137863][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.145672][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.153817][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.160905][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.168377][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.176604][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.183631][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.216794][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.225202][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.233192][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.241683][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.250045][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.257979][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.265635][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.273908][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.282302][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.289396][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.297554][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.306041][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.314182][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.321419][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.328964][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.337297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.345382][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.353455][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.361522][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.369833][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.378211][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.386392][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.394804][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.404848][ T287] device veth1_macvtap entered promiscuous mode [ 24.423922][ T289] device veth0_vlan entered promiscuous mode [ 24.432236][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.440245][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.448937][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.457569][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.466257][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.474258][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.482688][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.491071][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.499211][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.507437][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.515003][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.527702][ T286] device veth0_vlan entered promiscuous mode [ 24.542408][ T289] device veth1_macvtap entered promiscuous mode [ 24.550165][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.558507][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.567111][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.575287][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.583213][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.591475][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.599776][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.608572][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.616794][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.624682][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.633030][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.641652][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.649275][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.659563][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.668126][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.676669][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.685231][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.700968][ T286] device veth1_macvtap entered promiscuous mode [ 24.714215][ T285] device veth0_vlan entered promiscuous mode [ 24.724815][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.733059][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.741453][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.750206][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.758736][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.767225][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.775539][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.783820][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.791961][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.800138][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.808429][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.817126][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.825018][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.837432][ T288] device veth0_vlan entered promiscuous mode [ 24.857640][ T285] device veth1_macvtap entered promiscuous mode [ 24.865499][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.866181][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.875448][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.890485][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.899104][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.908109][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.916641][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.924969][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.933491][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.941415][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.948964][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.988098][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.001878][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.011678][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.023221][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.037669][ T288] device veth1_macvtap entered promiscuous mode [ 25.106257][ T315] loop0: detected capacity change from 0 to 512 [ 25.139480][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.149455][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.165871][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.176789][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.455987][ T326] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 28.002163][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 28.083333][ T30] audit: type=1400 audit(1781691220.877:96): avc: denied { write } for pid=310 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.110926][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.134809][ T315] EXT4-fs: failed to create workqueue [ 28.154688][ T315] EXT4-fs (loop0): mount failed [ 28.194865][ T30] audit: type=1400 audit(1781691220.887:97): avc: denied { read } for pid=310 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.215527][ T30] audit: type=1400 audit(1781691221.017:98): avc: denied { unlink } for pid=310 comm="syz.4.5" name="#1" dev="tmpfs" ino=24 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 28.274112][ T30] audit: type=1400 audit(1781691221.037:99): avc: denied { mount } for pid=310 comm="syz.4.5" name="/" dev="overlay" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 28.295702][ T30] audit: type=1400 audit(1781691222.737:100): avc: denied { prog_load } for pid=313 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 28.324372][ T30] audit: type=1400 audit(1781691222.737:101): avc: denied { bpf } for pid=313 comm="syz.3.4" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 28.364581][ T345] loop0: detected capacity change from 0 to 256 [ 28.372595][ T30] audit: type=1400 audit(1781691223.417:102): avc: denied { create } for pid=316 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.396176][ T30] audit: type=1400 audit(1781691223.417:103): avc: denied { map_create } for pid=316 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 28.416430][ T30] audit: type=1400 audit(1781691223.417:104): avc: denied { map_read map_write } for pid=316 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 28.478912][ T345] ======================================================= [ 28.478912][ T345] WARNING: The mand mount option has been deprecated and [ 28.478912][ T345] and is ignored by this kernel. Remove the mand [ 28.478912][ T345] option from the mount to silence this warning. [ 28.478912][ T345] ======================================================= [ 28.623295][ T30] audit: type=1400 audit(1781691223.417:105): avc: denied { read } for pid=313 comm="syz.3.4" name="ptp0" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 28.748125][ T345] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 28.936021][ T364] x_tables: duplicate underflow at hook 1 [ 28.974126][ T366] loop0: detected capacity change from 0 to 1024 [ 29.026483][ T366] EXT4-fs (loop0): Ignoring removed oldalloc option [ 29.036791][ T366] EXT4-fs (loop0): mounted filesystem without journal. Opts: usrjquota=,data_err=ignore,oldalloc,,errors=continue. Quota mode: none. [ 29.050801][ T366] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.091919][ T366] EXT4-fs (loop0): Unrecognized mount option "nogc_merge" or missing value [ 29.108585][ T347] syz.1.11 (347) used greatest stack depth: 21224 bytes left [ 29.212647][ T45] EXT4-fs error (device loop0): ext4_map_blocks:742: inode #15: comm kworker/u4:2: lblock 0 mapped to illegal pblock 0 (length 1) [ 29.260178][ T371] loop1: detected capacity change from 0 to 512 [ 29.271429][ T377] loop3: detected capacity change from 0 to 512 [ 29.278886][ T45] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 29.318540][ T45] EXT4-fs (loop0): This should not happen!! Data will be lost [ 29.318540][ T45] [ 29.341987][ T371] EXT4-fs (loop1): Test dummy encryption mode enabled [ 29.350371][ T371] EXT4-fs error (device loop1): ext4_orphan_get:1406: inode #15: comm syz.1.19: inode has both inline data and extents flags [ 29.363891][ T371] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.19: couldn't read orphan inode 15 (err -117) [ 29.384000][ T371] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 29.418052][ T371] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 29.428119][ T377] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 29.444116][ T377] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.486968][ T377] EXT4-fs error (device loop3): ext4_lookup:1858: inode #12: comm syz.3.22: iget: bad i_size value: 2533274857506816 [ 29.502601][ T377] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 29.565015][ T388] netlink: 388 bytes leftover after parsing attributes in process `syz.0.21'. [ 30.207716][ T390] loop0: detected capacity change from 0 to 1024 [ 30.262849][ T390] EXT4-fs (loop0): mounted filesystem without journal. Opts: acl,data_err=abort,,errors=continue. Quota mode: none. [ 30.613867][ T406] netlink: 'syz.4.28': attribute type 15 has an invalid length. [ 30.634236][ T406] netlink: 'syz.4.28': attribute type 15 has an invalid length. [ 31.171342][ T425] netlink: 220 bytes leftover after parsing attributes in process `syz.1.33'. [ 31.207424][ T427] netlink: 388 bytes leftover after parsing attributes in process `syz.1.35'. [ 31.344239][ T436] loop4: detected capacity change from 0 to 256 [ 31.454387][ T308] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.554022][ T440] Zero length message leads to an empty skb [ 31.706030][ T308] usb 1-1: Using ep0 maxpacket: 32 [ 31.824462][ T308] usb 1-1: config 2 has an invalid interface number: 88 but max is 0 [ 31.843120][ T308] usb 1-1: config 2 has no interface number 0 [ 31.854901][ T308] usb 1-1: config 2 interface 88 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 256 [ 31.884818][ T308] usb 1-1: config 2 interface 88 has no altsetting 0 [ 32.044605][ T308] usb 1-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 32.064111][ T308] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.094762][ T308] usb 1-1: Product: syz [ 32.099231][ T308] usb 1-1: Manufacturer: syz [ 32.104050][ T308] usb 1-1: SerialNumber: syz [ 32.144524][ T424] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 32.193755][ T488] cgroup: No subsys list or none specified [ 32.308497][ T498] netlink: 4 bytes leftover after parsing attributes in process `syz.3.68'. [ 32.364949][ T424] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 32.814452][ T308] asix 1-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 32.848918][ T308] asix: probe of 1-1:2.88 failed with error -71 [ 32.871255][ T308] usb 1-1: USB disconnect, device number 2 [ 32.948676][ T549] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 32.984979][ T293] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 33.004440][ T30] kauditd_printk_skb: 76 callbacks suppressed [ 33.004467][ T30] audit: type=1400 audit(1781691228.467:182): avc: denied { name_bind } for pid=537 comm="syz.3.84" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 33.222415][ T553] device syzkaller0 entered promiscuous mode [ 33.299548][ T30] audit: type=1400 audit(1781691228.817:183): avc: denied { read } for pid=558 comm="syz.1.93" dev="nsfs" ino=4026532340 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 33.320609][ T30] audit: type=1400 audit(1781691228.817:184): avc: denied { open } for pid=558 comm="syz.1.93" path="pid:[4026532340]" dev="nsfs" ino=4026532340 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 33.358910][ T30] audit: type=1400 audit(1781691228.877:185): avc: denied { create } for pid=560 comm="syz.1.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.378399][ T30] audit: type=1400 audit(1781691228.877:186): avc: denied { setopt } for pid=560 comm="syz.1.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.398810][ T30] audit: type=1400 audit(1781691228.877:187): avc: denied { read } for pid=560 comm="syz.1.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.433361][ T30] audit: type=1400 audit(1781691228.947:188): avc: denied { write } for pid=560 comm="syz.1.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.452800][ T293] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.463175][ T293] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 33.472966][ T293] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 33.490428][ T293] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.504906][ T293] usb 5-1: config 0 descriptor?? [ 33.538345][ T30] audit: type=1400 audit(1781691229.057:189): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 33.668527][ T30] audit: type=1400 audit(1781691229.187:190): avc: denied { bind } for pid=584 comm="syz.0.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.732454][ T588] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 33.735067][ T30] audit: type=1400 audit(1781691229.247:191): avc: denied { name_bind } for pid=591 comm="syz.2.107" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 33.794412][ T307] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.794665][ T293] usb 5-1: string descriptor 0 read error: -71 [ 33.827012][ T293] usb 5-1: USB disconnect, device number 2 [ 33.833491][ T309] udevd[309]: setting mode of /dev/bus/usb/005/002 to 020664 failed: No such file or directory [ 33.848132][ T309] udevd[309]: setting owner of /dev/bus/usb/005/002 to uid=0, gid=0 failed: No such file or directory [ 33.895403][ T581] syz.3.104 (581) used greatest stack depth: 20872 bytes left [ 34.044412][ T307] usb 2-1: Using ep0 maxpacket: 16 [ 34.134399][ T308] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.164458][ T307] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 34.314433][ T387] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 34.334831][ T307] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 34.344039][ T307] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.352578][ T307] usb 2-1: Product: syz [ 34.357060][ T307] usb 2-1: Manufacturer: syz [ 34.361759][ T307] usb 2-1: SerialNumber: syz [ 34.367457][ T307] usb 2-1: config 0 descriptor?? [ 34.374376][ T308] usb 3-1: Using ep0 maxpacket: 32 [ 34.494449][ T308] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 34.502753][ T308] usb 3-1: config 0 has no interface number 0 [ 34.508972][ T308] usb 3-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 34.519729][ T308] usb 3-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0xE3, skipping [ 34.530569][ T308] usb 3-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.606033][ T572] UDC core: couldn't find an available UDC or it's busy: -16 [ 34.613790][ T572] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 34.622283][ T572] UDC core: couldn't find an available UDC or it's busy: -16 [ 34.629828][ T572] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 34.638856][ T306] usb 2-1: USB disconnect, device number 2 [ 34.674472][ T387] usb 4-1: config 0 has no interfaces? [ 34.680070][ T387] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 34.689893][ T387] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.694776][ T308] usb 3-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 34.707050][ T387] usb 4-1: config 0 descriptor?? [ 34.707768][ T308] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.720254][ T308] usb 3-1: Product: syz [ 34.724514][ T308] usb 3-1: Manufacturer: syz [ 34.729134][ T308] usb 3-1: SerialNumber: syz [ 34.737914][ T308] usb 3-1: config 0 descriptor?? [ 34.775208][ T308] usbhid 3-1:0.119: couldn't find an input interrupt endpoint [ 34.904405][ T307] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 34.976880][ T308] usb 3-1: USB disconnect, device number 2 [ 35.244666][ T639] netlink: 4 bytes leftover after parsing attributes in process `syz.1.127'. [ 35.264435][ T307] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 35.273223][ T307] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 35.284009][ T307] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 35.294568][ T307] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 35.421797][ T651] kvm: pic: single mode not supported [ 35.424550][ T307] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 35.439656][ T307] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 35.447740][ T307] usb 5-1: Product: syz [ 35.451929][ T307] usb 5-1: Manufacturer: syz [ 35.474482][ T623] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 35.495130][ T307] cdc_wdm 5-1:1.0: skipping garbage [ 35.506144][ T307] cdc_wdm 5-1:1.0: skipping garbage [ 35.511554][ T307] cdc_wdm: probe of 5-1:1.0 failed with error -22 [ 35.709640][ T306] usb 5-1: USB disconnect, device number 3 [ 35.834376][ T387] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 36.234589][ T387] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.247502][ T387] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 36.256750][ T387] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 36.266263][ T387] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.275310][ T387] usb 1-1: config 0 descriptor?? [ 36.305744][ T675] tipc: Started in network mode [ 36.310882][ T675] tipc: Node identity c6445cc8d916, cluster identity 4711 [ 36.319607][ T675] tipc: Enabled bearer , priority 0 [ 36.327663][ T675] device syzkaller0 entered promiscuous mode [ 36.354671][ T675] tipc: Resetting bearer [ 36.365357][ T674] tipc: Resetting bearer [ 36.379833][ T674] tipc: Disabling bearer [ 36.408920][ T683] input: syz0 as /devices/virtual/input/input4 [ 36.431255][ T685] netlink: 8 bytes leftover after parsing attributes in process `syz.1.148'. [ 36.453521][ T689] netlink: 12 bytes leftover after parsing attributes in process `syz.1.150'. [ 36.462732][ T689] netlink: 4 bytes leftover after parsing attributes in process `syz.1.150'. [ 36.519725][ T665] UDC core: couldn't find an available UDC or it's busy: -16 [ 36.527320][ T665] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 36.535347][ T6] usb 1-1: USB disconnect, device number 3 [ 36.634399][ T307] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 36.744419][ T60] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.994519][ T307] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 37.054498][ T306] usb 4-1: USB disconnect, device number 2 [ 37.104511][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.122146][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.137994][ T60] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 37.164480][ T307] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 37.173572][ T307] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.181829][ T60] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 37.198075][ T60] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.206408][ T307] usb 5-1: Product: syz [ 37.210774][ T307] usb 5-1: Manufacturer: syz [ 37.215963][ T307] usb 5-1: SerialNumber: syz [ 37.221309][ T60] usb 2-1: config 0 descriptor?? [ 37.235083][ T307] usb 5-1: config 0 descriptor?? [ 37.254460][ T679] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 37.484153][ T307] usb 5-1: USB disconnect, device number 4 [ 37.574399][ T306] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 37.725809][ T60] plantronics 0003:047F:FFFF.0001: unknown main item tag 0xe [ 37.733641][ T60] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 37.741605][ T60] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 37.752840][ T60] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 37.844377][ T306] usb 4-1: Using ep0 maxpacket: 8 [ 37.998860][ T307] usb 2-1: USB disconnect, device number 3 [ 38.068127][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 38.068143][ T30] audit: type=1400 audit(1781691233.587:209): avc: denied { create } for pid=726 comm="syz.0.165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 38.100009][ T30] audit: type=1400 audit(1781691233.617:210): avc: denied { setopt } for pid=726 comm="syz.0.165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 38.155900][ T30] audit: type=1400 audit(1781691233.677:211): avc: denied { read } for pid=732 comm="syz.0.168" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 38.184500][ T306] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 38.210153][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.218386][ T39] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.225956][ T306] usb 4-1: Product: syz [ 38.230229][ T306] usb 4-1: Manufacturer: syz [ 38.235091][ T306] usb 4-1: SerialNumber: syz [ 38.240506][ T306] usb 4-1: config 0 descriptor?? [ 38.464436][ T60] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 38.474397][ T39] usb 3-1: Using ep0 maxpacket: 16 [ 38.496008][ T713] UDC core: couldn't find an available UDC or it's busy: -16 [ 38.503422][ T713] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 38.564412][ T306] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 38.594457][ T39] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 38.602543][ T39] usb 3-1: config 0 has no interface number 0 [ 38.764483][ T39] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 38.773603][ T39] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.781705][ T39] usb 3-1: Product: syz [ 38.785911][ T387] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 38.793406][ T39] usb 3-1: Manufacturer: syz [ 38.798048][ T39] usb 3-1: SerialNumber: syz [ 38.803226][ T39] usb 3-1: config 0 descriptor?? [ 38.834498][ T60] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 38.844785][ T60] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 38.853864][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.924441][ T306] usb 5-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 38.933276][ T306] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 39.094462][ T306] usb 5-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 39.103621][ T306] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.111847][ T306] usb 5-1: Product: syz [ 39.116118][ T306] usb 5-1: Manufacturer: syz [ 39.120733][ T306] usb 5-1: SerialNumber: syz [ 39.126372][ T306] usb 5-1: config 0 descriptor?? [ 39.144692][ T387] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.155778][ T387] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 39.166016][ T387] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.174777][ T387] usb 2-1: config 0 descriptor?? [ 39.514420][ T387] usbhid 2-1:0.0: can't add hid device: -71 [ 39.520510][ T387] usbhid: probe of 2-1:0.0 failed with error -71 [ 39.527768][ T387] usb 2-1: USB disconnect, device number 4 [ 39.994391][ T387] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 40.208295][ T6] usb 4-1: USB disconnect, device number 3 [ 40.223375][ T749] input: syz0 as /devices/virtual/input/input5 [ 40.274799][ T755] device bridge_slave_0 left promiscuous mode [ 40.281099][ T755] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.289287][ T755] device bridge_slave_1 left promiscuous mode [ 40.295613][ T755] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.364459][ T387] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.375489][ T387] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 40.384594][ T387] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.393342][ T387] usb 2-1: config 0 descriptor?? [ 40.714418][ T6] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 40.939812][ T306] usb 3-1: USB disconnect, device number 3 [ 40.954425][ T6] usb 4-1: Using ep0 maxpacket: 8 [ 41.206670][ T307] usb 1-1: USB disconnect, device number 4 [ 41.234491][ T6] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 41.243585][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.252346][ T6] usb 4-1: Product: syz [ 41.256705][ T6] usb 4-1: Manufacturer: syz [ 41.261322][ T6] usb 4-1: SerialNumber: syz [ 41.266951][ T6] usb 4-1: config 0 descriptor?? [ 41.294394][ T306] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 41.324415][ T387] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 41.335357][ T387] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input6 [ 41.346912][ T60] usb 5-1: USB disconnect, device number 5 [ 41.544397][ T306] usb 3-1: Using ep0 maxpacket: 32 [ 41.568523][ T387] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 41.585090][ T387] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 41.635726][ T30] audit: type=1400 audit(1781691237.157:212): avc: denied { write } for pid=774 comm="syz.0.184" name="hidraw0" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 41.674444][ T306] usb 3-1: config 0 has an invalid interface number: 74 but max is 0 [ 41.682726][ T306] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 41.693029][ T306] usb 3-1: config 0 has no interface number 0 [ 41.699261][ T306] usb 3-1: config 0 interface 74 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 41.710441][ T306] usb 3-1: config 0 interface 74 has no altsetting 0 [ 41.724392][ T60] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 41.747480][ T30] audit: type=1400 audit(1781691237.267:213): avc: denied { mount } for pid=780 comm="syz.0.186" name="/" dev="ramfs" ino=18578 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 41.844396][ C1] ================================================================================ [ 41.853724][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 41.862350][ C1] index 259 is out of range for type 'const int[34]' [ 41.869042][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 [ 41.876067][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 41.886132][ C1] Call Trace: [ 41.889414][ C1] [ 41.892260][ C1] __dump_stack+0x21/0x30 [ 41.896610][ C1] dump_stack_lvl+0x110/0x170 [ 41.901298][ C1] ? show_regs_print_info+0x20/0x20 [ 41.906507][ C1] dump_stack+0x15/0x20 [ 41.910715][ C1] ubsan_epilogue+0xe/0x40 [ 41.915159][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 41.920924][ C1] aiptek_irq+0x2045/0x29b0 [ 41.925455][ C1] ? kcov_remote_start+0x217/0x350 [ 41.930577][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 41.935966][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 41.941185][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 41.946043][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 41.951951][ C1] dummy_timer+0xa34/0x31d0 [ 41.956468][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 41.961675][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 41.966880][ C1] call_timer_fn+0x38/0x290 [ 41.971412][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 41.976631][ C1] __run_timers+0x637/0x9a0 [ 41.981156][ C1] ? calc_index+0x200/0x200 [ 41.985680][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 41.990553][ C1] run_timer_softirq+0x6a/0xf0 [ 41.995337][ C1] handle_softirqs+0x250/0x560 [ 42.000116][ C1] ? irqtime_account_irq+0xbe/0x390 [ 42.005327][ C1] __irq_exit_rcu+0x52/0xf0 [ 42.009857][ C1] irq_exit_rcu+0x9/0x10 [ 42.014112][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 42.019758][ C1] [ 42.022709][ C1] [ 42.025669][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 42.031669][ C1] RIP: 0010:default_idle+0xf/0x20 [ 42.036712][ C1] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d1 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 22 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 42.056334][ C1] RSP: 0018:ffffc90000157db8 EFLAGS: 00000246 [ 42.062416][ C1] RAX: 000000000001063a RBX: ffff888100308000 RCX: 000000000001063a [ 42.070404][ C1] RDX: 0000000000000001 RSI: ffffffff856380e0 RDI: ffffffff856380a0 [ 42.078388][ C1] RBP: ffffc90000157db8 R08: ffff8881f7138c73 R09: 1ffff1103ee2718e [ 42.086377][ C1] R10: dffffc0000000000 R11: ffffed103ee2718f R12: 0000000000000000 [ 42.094367][ C1] R13: 1ffff11020061000 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.102356][ C1] arch_cpu_idle+0xa/0x10 [ 42.106709][ C1] default_idle_call+0x71/0x1d0 [ 42.111577][ C1] do_idle+0x368/0x620 [ 42.115666][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 42.120909][ C1] cpu_startup_entry+0x18/0x20 [ 42.125699][ C1] start_secondary+0x2c8/0x380 [ 42.130484][ C1] secondary_startup_64_no_verify+0xb1/0xbb [ 42.136438][ C1] [ 42.139469][ C1] ================================================================================ [ 42.148771][ C1] ================================================================== [ 42.156842][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 [ 42.164408][ C1] Read of size 4 at addr ffffffff857edcac by task swapper/1/0 [ 42.171873][ C1] [ 42.174204][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 [ 42.181239][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 42.191314][ C1] Call Trace: [ 42.194611][ C1] [ 42.197478][ C1] __dump_stack+0x21/0x30 [ 42.201841][ C1] dump_stack_lvl+0x110/0x170 [ 42.206546][ C1] ? show_regs_print_info+0x20/0x20 [ 42.211759][ C1] ? load_image+0x3f0/0x3f0 [ 42.216280][ C1] ? dump_stack_lvl+0x134/0x170 [ 42.221145][ C1] print_address_description+0x7f/0x2c0 [ 42.226707][ C1] ? aiptek_irq+0x2063/0x29b0 [ 42.231398][ C1] kasan_report+0x10f/0x150 [ 42.235923][ C1] ? aiptek_irq+0x2063/0x29b0 [ 42.240644][ C1] __asan_report_load4_noabort+0x14/0x20 [ 42.246314][ C1] aiptek_irq+0x2063/0x29b0 [ 42.250846][ C1] ? kcov_remote_start+0x217/0x350 [ 42.255989][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 42.261378][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 42.266593][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 42.271465][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 42.277372][ C1] dummy_timer+0xa34/0x31d0 [ 42.281900][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.287120][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.292341][ C1] call_timer_fn+0x38/0x290 [ 42.296872][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.302087][ C1] __run_timers+0x637/0x9a0 [ 42.306611][ C1] ? calc_index+0x200/0x200 [ 42.311128][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 42.315991][ C1] run_timer_softirq+0x6a/0xf0 [ 42.320776][ C1] handle_softirqs+0x250/0x560 [ 42.325553][ C1] ? irqtime_account_irq+0xbe/0x390 [ 42.330858][ C1] __irq_exit_rcu+0x52/0xf0 [ 42.335385][ C1] irq_exit_rcu+0x9/0x10 [ 42.339652][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 42.345305][ C1] [ 42.348250][ C1] [ 42.351193][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 42.357188][ C1] RIP: 0010:default_idle+0xf/0x20 [ 42.362256][ C1] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d1 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 22 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 42.381884][ C1] RSP: 0018:ffffc90000157db8 EFLAGS: 00000246 [ 42.387971][ C1] RAX: 000000000001063a RBX: ffff888100308000 RCX: 000000000001063a [ 42.395957][ C1] RDX: 0000000000000001 RSI: ffffffff856380e0 RDI: ffffffff856380a0 [ 42.403949][ C1] RBP: ffffc90000157db8 R08: ffff8881f7138c73 R09: 1ffff1103ee2718e [ 42.411935][ C1] R10: dffffc0000000000 R11: ffffed103ee2718f R12: 0000000000000000 [ 42.419920][ C1] R13: 1ffff11020061000 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.427908][ C1] arch_cpu_idle+0xa/0x10 [ 42.432258][ C1] default_idle_call+0x71/0x1d0 [ 42.437122][ C1] do_idle+0x368/0x620 [ 42.441215][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 42.446429][ C1] cpu_startup_entry+0x18/0x20 [ 42.451211][ C1] start_secondary+0x2c8/0x380 [ 42.455988][ C1] secondary_startup_64_no_verify+0xb1/0xbb [ 42.461906][ C1] [ 42.464933][ C1] [ 42.467264][ C1] The buggy address belongs to the variable: [ 42.473238][ C1] .str.24+0xc/0x20 [ 42.477061][ C1] [ 42.479392][ C1] Memory state around the buggy address: [ 42.485029][ C1] ffffffff857edb80: 00 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 00 00 00 00 [ 42.493111][ C1] ffffffff857edc00: 00 03 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 07 f9 f9 f9 [ 42.501343][ C1] >ffffffff857edc80: 00 05 f9 f9 04 f9 f9 f9 00 f9 f9 f9 07 f9 f9 f9 [ 42.509431][ C1] ^ [ 42.514820][ C1] ffffffff857edd00: 06 f9 f9 f9 07 f9 f9 f9 00 00 00 00 00 00 00 00 [ 42.522896][ C1] ffffffff857edd80: f9 f9 f9 f9 00 00 f9 f9 00 01 f9 f9 00 01 f9 f9 [ 42.530993][ C1] ================================================================== [ 42.539064][ C1] Disabling lock debugging due to kernel taint [ 42.545226][ C1] ================================================================================ [ 42.554511][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 42.563104][ C1] index 260 is out of range for type 'const int[34]' [ 42.569891][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0 [ 42.578327][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 42.588511][ C1] Call Trace: [ 42.591816][ C1] [ 42.594672][ C1] __dump_stack+0x21/0x30 [ 42.599046][ C1] dump_stack_lvl+0x110/0x170 [ 42.603739][ C1] ? show_regs_print_info+0x20/0x20 [ 42.608955][ C1] dump_stack+0x15/0x20 [ 42.613128][ C1] ubsan_epilogue+0xe/0x40 [ 42.617565][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 42.623317][ C1] aiptek_irq+0x1f14/0x29b0 [ 42.627838][ C1] ? kcov_remote_start+0x217/0x350 [ 42.632968][ C1] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 42.638351][ C1] usb_hcd_giveback_urb+0x11d/0x3f0 [ 42.643563][ C1] ? _raw_spin_unlock+0x4d/0x70 [ 42.648435][ C1] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 42.654347][ C1] dummy_timer+0xa34/0x31d0 [ 42.658874][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.664089][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.669309][ C1] call_timer_fn+0x38/0x290 [ 42.673828][ C1] ? dummy_free_streams+0x5c0/0x5c0 [ 42.679040][ C1] __run_timers+0x637/0x9a0 [ 42.683562][ C1] ? calc_index+0x200/0x200 [ 42.688079][ C1] ? sched_clock_cpu+0x18/0x3d0 [ 42.692951][ C1] run_timer_softirq+0x6a/0xf0 [ 42.697733][ C1] handle_softirqs+0x250/0x560 [ 42.702514][ C1] ? irqtime_account_irq+0xbe/0x390 [ 42.707727][ C1] __irq_exit_rcu+0x52/0xf0 [ 42.712250][ C1] irq_exit_rcu+0x9/0x10 [ 42.716512][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 42.722162][ C1] [ 42.725100][ C1] [ 42.728047][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 42.734044][ C1] RIP: 0010:default_idle+0xf/0x20 [ 42.739091][ C1] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d1 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 22 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 42.758714][ C1] RSP: 0018:ffffc90000157db8 EFLAGS: 00000246 [ 42.764797][ C1] RAX: 000000000001063a RBX: ffff888100308000 RCX: 000000000001063a [ 42.772783][ C1] RDX: 0000000000000001 RSI: ffffffff856380e0 RDI: ffffffff856380a0 [ 42.780770][ C1] RBP: ffffc90000157db8 R08: ffff8881f7138c73 R09: 1ffff1103ee2718e [ 42.788756][ C1] R10: dffffc0000000000 R11: ffffed103ee2718f R12: 0000000000000000 [ 42.796750][ C1] R13: 1ffff11020061000 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.804742][ C1] arch_cpu_idle+0xa/0x10 [ 42.809089][ C1] default_idle_call+0x71/0x1d0 [ 42.813955][ C1] do_idle+0x368/0x620 [ 42.818032][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 42.823246][ C1] cpu_startup_entry+0x18/0x20 [ 42.828023][ C1] start_secondary+0x2c8/0x380 [ 42.832808][ C1] secondary_startup_64_no_verify+0xb1/0xbb [ 42.838722][ C1] [ 42.841758][ C1] ================================================================================ [ 42.851613][ T60] usb 5-1: Using ep0 maxpacket: 8 [ 42.856954][ T6] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 42.870716][ T39] usb 2-1: USB disconnect, device number 5 [ 42.894502][ T306] usb 3-1: New USB device found, idVendor=1ae7, idProduct=9003, bcdDevice=44.08 [ 42.903843][ T306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.912165][ T306] usb 3-1: Product: syz [ 42.916520][ T306] usb 3-1: Manufacturer: syz [ 42.921501][ T306] usb 3-1: SerialNumber: syz [ 42.928925][ T306] usb 3-1: config 0 descriptor?? [ 42.984752][ T60] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 42.992930][ T60] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 43.004259][ T60] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 43.014378][ T60] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 43.025690][ T60] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 43.035829][ T60] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 43.048851][ T60] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 43.057922][ T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.114419][ T6] usb 1-1: Using ep0 maxpacket: 16 [ 43.234481][ T6] usb 1-1: config 3 has an invalid interface number: 20 but max is 0 [ 43.242735][ T6] usb 1-1: config 3 has no interface number 0 [ 43.248885][ T6] usb 1-1: config 3 interface 20 has no altsetting 0 [ 43.326518][ T39] usb 4-1: USB disconnect, device number 4 [ 43.414461][ T6] usb 1-1: New USB device found, idVendor=05ac, idProduct=0246, bcdDevice=27.b1 [ 43.423601][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.431663][ T6] usb 1-1: Product: syz [ 43.435891][ T6] usb 1-1: Manufacturer: syz [ 43.440496][ T6] usb 1-1: SerialNumber: syz [ 43.764900][ T6] usbhid 1-1:3.20: couldn't find an input interrupt endpoint [ 43.773283][ T6] usb 1-1: USB disconnect, device number 5 [ 43.973006][ T692] usb 3-1: USB disconnect, device number 4 [ 44.663232][ T6] usb 5-1: USB disconnect, device number 6